tegwick
3bd576990b
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e782-9f45-7382-afff-77ad665b88ec
57 lines
3.9 KiB
Markdown
57 lines
3.9 KiB
Markdown
# Owner evidence required to complete G1
|
|
|
|
Decision `5f3680fc-0cd5-4d27-ba39-59fbdd13313c` remains open. The previous
|
|
credential request was denied by the policy gate. This contract can be fulfilled
|
|
by an authorized forge owner; it does not authorize this project to impersonate
|
|
that owner, mint credentials, or use State Hub's workload credential.
|
|
|
|
## Export contents
|
|
|
|
Provide a JSON export with the fields below. A successful HTTP response, an
|
|
empty list, or a site-admin flag alone is not proof of coverage.
|
|
|
|
| Section | Required evidence |
|
|
| --- | --- |
|
|
| provenance | Capture time, source instance URL, product/version, authenticated principal identifier (no token), export tool/revision, owner attestation and scope |
|
|
| repositories | Immutable ID, current owner/name, visibility, archive state, default branch and revision; include private and archived repositories |
|
|
| packages | Immutable package/version identity where supported, owner, type, name, tags/digests, repository association separately; include unlinked packages and retained rollback versions |
|
|
| access | Actual org/team membership and repository grants, direct collaborators, branch protections, machine-reader grants; distinguish inherited from direct grants |
|
|
| automation | Deploy-key IDs and read/write flags (no key bytes), webhook IDs and destination host/path without query credentials, runner associations and reusable workflow consumers |
|
|
| pagination | Endpoint/filter and observed counts for every page, termination evidence, API permission failures and omissions; no silent partial success |
|
|
| consumers | GitOps source allowlists and repository credential references, runtime/current and rollback image consumers, package index users, external clones/CI and frozen-cluster consumers |
|
|
| completeness | Owner-confirmed reconciliation with this project's public/local/registered census; every omission explicitly accepted or blocking |
|
|
|
|
Do not export credential values, key bytes, Secret objects, webhook secrets,
|
|
auth headers, token-bearing URLs or raw environment/configuration dumps.
|
|
Names and grant IDs are sufficient for the access comparison. Record unavailable
|
|
surfaces as blockers rather than replacing them with empty accepted lists.
|
|
|
|
## Acceptance procedure
|
|
|
|
1. Validate identities and pagination; reconcile the 12 local paths absent from
|
|
the anonymous census, remote-only private repos and archived repos.
|
|
2. Join repo/package identities to the assignment matrix. Do not derive package
|
|
ownership from Git repository ownership.
|
|
3. Reconcile reference locations, runtime consumers and each excluded surface.
|
|
4. Record grant-preservation checks for every proposed transfer; no broad new
|
|
org membership may silently widen access.
|
|
5. Capture two consecutive source/server/runtime snapshots in a declared
|
|
unchanged-fleet window. Stop acceptance if revisions, content, grants or
|
|
consumer sets change. Compare semantic inventory and record provenance.
|
|
6. Only after owner attestation and all coverage gaps are closed may G1 and
|
|
condition 3 be accepted. Stable partial output is insufficient.
|
|
|
|
## Existing owner records
|
|
|
|
- WARDEN-WP-0025 — `70c11222-d8e7-5936-99f7-7d626a4a5deb`: admin PAT lane
|
|
establishment. Historical success does not establish current caller access.
|
|
- WARDEN-WP-0031 — `739bad25-2345-5f4f-aaa3-cc4cd8c71f6c`: caller identity
|
|
on policy requests. Its documented 403 distinction concerns system binding;
|
|
it supplies the right diagnostic owner, not permission to substitute an identity.
|
|
- MASON-WP-0003 — `4015b46d-02f1-56ac-853e-87e8542cf0dd`: State Hub's narrow
|
|
forge-read workload lane. This is a separate principal and use; it is not an
|
|
alternative credential for this project following the denial.
|
|
|
|
These are context records, not newly accepted owner follow-ups. A new repair or
|
|
export activity must retain its owner's own record and be linked here once it
|
|
exists. No owner messages or task assignments have been sent.
|